In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
AND |
|
Configuration 10 (hide)
AND |
|
Configuration 11 (hide)
AND |
|
Configuration 12 (hide)
AND |
|
Configuration 13 (hide)
AND |
|
Configuration 14 (hide)
AND |
|
Configuration 15 (hide)
|
Configuration 16 (hide)
|
Configuration 17 (hide)
|
History
21 Nov 2024, 04:56
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html - Broken Link | |
References | () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html - Broken Link | |
References | () http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html - Broken Link | |
References | () http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
References | () https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/Â - Release Notes, Vendor Advisory | |
References | () https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77Â - Patch, Third Party Advisory | |
References | () https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2Â - Mitigation, Third Party Advisory | |
References | () https://jquery.com/upgrade-guide/3.5/Â - Mitigation, Vendor Advisory | |
References | () https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3EÂ - | |
References | () https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html - Mailing List, Third Party Advisory | |
References | () https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/Â - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/Â - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/Â - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/Â - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/Â - | |
References | () https://security.gentoo.org/glsa/202007-03Â - Third Party Advisory | |
References | () https://security.netapp.com/advisory/ntap-20200511-0006/Â - Third Party Advisory | |
References | () https://www.debian.org/security/2020/dsa-4693Â - Third Party Advisory | |
References | () https://www.drupal.org/sa-core-2020-002Â - Third Party Advisory | |
References | () https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujan2022.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujul2020.html - Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujul2022.html - | |
References | () https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory | |
References | () https://www.tenable.com/security/tns-2020-10Â - Third Party Advisory | |
References | () https://www.tenable.com/security/tns-2020-11Â - Third Party Advisory | |
References | () https://www.tenable.com/security/tns-2021-02Â - Third Party Advisory | |
References | () https://www.tenable.com/security/tns-2021-10Â - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.9 |
Information
Published : 2020-04-29 22:15
Updated : 2024-11-21 04:56
NVD link : CVE-2020-11022
Mitre link : CVE-2020-11022
CVE.ORG link : CVE-2020-11022
JSON object : View
Products Affected
oracle
- financial_services_price_creation_and_discovery
- financial_services_market_risk_measurement_and_management
- storagetek_acsls
- application_testing_suite
- enterprise_session_border_controller
- retail_back_office
- financial_services_regulatory_reporting_for_european_banking_authority
- banking_digital_experience
- policy_automation
- agile_product_lifecycle_management_for_process
- healthcare_foundation
- financial_services_balance_sheet_planning
- policy_automation_for_mobile_devices
- financial_services_analytical_applications_infrastructure
- financial_services_profitability_management
- financial_services_analytical_applications_reconciliation_framework
- communications_application_session_controller
- financial_services_liquidity_risk_measurement_and_management
- financial_services_hedge_management_and_ifrs_valuations
- blockchain_platform
- financial_services_asset_liability_management
- insurance_data_foundation
- retail_returns_management
- hospitality_materials_control
- jdeveloper
- financial_services_basel_regulatory_capital_basic
- communications_webrtc_session_controller
- policy_automation_connector_for_siebel
- siebel_ui_framework
- financial_services_data_governance_for_us_regulatory_reporting
- retail_customer_management_and_segmentation_foundation
- financial_services_basel_regulatory_capital_internal_ratings_based_approach
- financial_services_data_foundation
- insurance_accounting_analyzer
- communications_billing_and_revenue_management
- financial_services_loan_loss_forecasting_and_provisioning
- peoplesoft_enterprise_peopletools
- weblogic_server
- communications_services_gatekeeper
- financial_services_regulatory_reporting_for_us_federal_reserve
- communications_diameter_signaling_router_idih\
- financial_services_funds_transfer_pricing
- financial_services_institutional_performance_analytics
- financial_services_liquidity_risk_management
- financial_services_data_integration_hub
- communications_eagle_application_processor
- enterprise_manager_ops_center
- insurance_allocation_manager_for_enterprise_profitability
- insurance_insbridge_rating_and_underwriting
- hospitality_simphony
- agile_product_supplier_collaboration_for_process
netapp
- h700e_firmware
- h500e_firmware
- h500e
- h500s_firmware
- h410c
- h410s_firmware
- h700s
- snap_creator_framework
- oncommand_system_manager
- h700e
- h300e_firmware
- max_data
- h500s
- h300s_firmware
- snapcenter
- h700s_firmware
- h300s
- h410c_firmware
- h410s
- oncommand_insight
- h300e
jquery
- jquery
fedoraproject
- fedora
tenable
- log_correlation_engine
debian
- debian_linux
drupal
- drupal
opensuse
- leap
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')